SID 1:50695

Report a false positive

Rule Category

MALWARE-OTHER --

Alert Message

MALWARE-OTHER Microsoft Office Equation Editor remote code execution attempt

Rule Explanation

This event is generated when an RTF file that is seen using indicators observed in APT group activity. Impact: Potential Code Execution Details: This rule targets an APT campaign leveraging CVE-2018-0798 which exploits an undisclosed vector in the Equation Editor for Microsoft Office. In particular this is geared towards the overwrite of the least significant two bytes of the return address for code execution. Ease of Attack: Easy

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

CVE-2018-0798

Additional Links

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798

Rule Vulnerability

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2018-0798
 Loading description